Home/ Questions/Q 254609
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T21:51:39+00:00

We want to allow DB access (Oracle) to our users only through our own

  • 0

We want to allow DB access (Oracle) to our users only through our own application – let’s call it “ourTool.exe”, installed locally on the users computers. Currently, the users must provide username/password whenever they start “ourTool”. The provided password password gets decrypted and we use username/decrypted-password to finally log in to the Oracle DB. This approach prevents the users from directly accessing our DB using third party tools (SQLplus, Excel, Access, …) and everything in the DB is guaranteed to have been entered/edited using “ourTool”.

Now, one of our clients wants to allow its users “single sign-on” (with SmartCards/Oracle PKI). With this, the user will be able connect to our DB without providing any password every time they start “ourTool”. But the same will be true for the potentially dangerous tools like SQLplus, Excel, Access, etc.

Is there a way to prevent this? How can we make sure that every record in our DB is only created/edited/deleted using “ourTool” in this scenario?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Since it’s your application and you have control of the source, you can use either password protected database roles or Secure Application Roles that are enabled from ourTool.exe. (see http://www.oracle.com/technology/obe/obe10gdb/security/approles/approles.htm ).

    For example, with a password-protected database role, the initial connection would be with only the CREATE SESSION privilege, and then ourTool.exe would issue the SET ROLE with password known only to you. Any other application doesn’t have the information to set the role. Obviously, the privileges are granted only to the role and not directly to the user in this configuration.

    • 0